Remote BMS access: managing a building without exposing it to outsiders

Being able to open the BMS on a phone is convenient: an engineer can see an alarm, check a trend and prepare for a site visit. But alongside the graph, they may also gain access to commands capable of changing the building's physical operation.

Remote access is a separate engineering function with its own boundaries, not simply a link to a controller. NIST classifies building automation as operational technology, where safety and the continuity of physical processes matter alongside data. ¹

Start with who needs what

Reports may be enough for the owner. An operator needs operating modes and alarms. A service engineer needs diagnostics and limited changes. A controls developer needs separate access for agreed work.

We would not combine these roles under a single administrator account. Nor would we retain access for a former contractor merely because it was used during commissioning.

Imagine a simple situation: someone only needs to view an AHU fault, but the account issued allows them to change every schedule on the site. Functionally, the task is covered, but the scope of access is disproportionate. This is precisely what should be checked before enabling remote service access.

Secure the connection path

NIST recommends OT network segmentation, control of permitted connections and a justified scope of remote access. Secure channels and multi-factor authentication are considered for this access. Access must not bypass existing protective functions. ¹

In practice, this means designing a controlled entry point, rather than exposing the controls interface to anyone who knows the address. A VPN or secure gateway is a tool within this architecture, not a guarantee of security without correctly configured accounts and settings.

The arrangement must be agreed with the IT team and those responsible for operations. An approach where ‘the contractor installed their own router, but nobody knows exactly how it works’ leaves the owner with an uncontrolled dependency.

An open protocol does not mean a secure protocol

BACnet/SC adds secure communication with encryption and device authentication. BACnet International explicitly describes it as part of overall protection, not a replacement for all other measures. ²

Modbus also has a separate Security Protocol based on TLS. The presence of standard Modbus TCP does not prove that this secure variant is implemented in your equipment. ³

Even an encrypted channel does not establish whether a particular user should be allowed to change a temperature or switch off a unit. Transport security and action permissions must be considered separately.

The internet connection is lost. What happens to the HVAC?

We would include this question in the acceptance test programme. External analytics may become unavailable, but agreed local control must remain in place for critical functions.

The safe response differs between systems. An unjustified cooling shutdown is unacceptable for a server room; for other equipment, the design may require a shutdown. We therefore do not specify a universal ‘switch everything off’ or ‘retain the last command indefinitely’.

For temporary optimisation commands, it is sensible to define a validity period and a procedure for returning to the normal control sequence. If the controller does not support this, the limitation must be addressed in the architecture, not left as a verbal agreement.

Logging and recovery

The client needs an audit trail: who connected, what they changed and when. Up-to-date backups and a tested recovery method are also essential. BMS manufacturers distinguish between backup and recovery procedures and specify version compatibility restrictions; this is evident, for example, in the Metasys SCT documentation. ⁴

Recovery is tested in an agreed environment, not by experimenting on a live critical system.

Good remote support reduces the time to a solution. It should not make the building’s operation dependent on an unknown password, someone else’s laptop or a permanent internet connection.